@riocrypto/common-server 1.0.2741 → 1.0.2743

package/build/helpers/get-is-fireblocks-signature-valid.d.ts

@@ -1,2 +1,2 @@
 import { Request } from "express";
-export declare const getIsFireblocksWebhookValid: (req: Request) => boolean;
+export declare const getIsFireblocksWebhookValid: (req: Request) => Promise<boolean>;

package/build/helpers/get-is-fireblocks-signature-valid.js

@@ -1,33 +1,35 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIsFireblocksWebhookValid = void 0;
-const crypto_1 = __importDefault(require("crypto"));
-const publicKey = `-----BEGIN PUBLIC KEY-----
-MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0+6wd9OJQpK60ZI7qnZG
-jjQ0wNFUHfRv85Tdyek8+ahlg1Ph8uhwl4N6DZw5LwLXhNjzAbQ8LGPxt36RUZl5
-YlxTru0jZNKx5lslR+H4i936A4pKBjgiMmSkVwXD9HcfKHTp70GQ812+J0Fvti/v
-4nrrUpc011Wo4F6omt1QcYsi4GTI5OsEbeKQ24BtUd6Z1Nm/EP7PfPxeb4CP8KOH
-clM8K7OwBUfWrip8Ptljjz9BNOZUF94iyjJ/BIzGJjyCntho64ehpUYP8UJykLVd
-CGcu7sVYWnknf1ZGLuqqZQt4qt7cUUhFGielssZP9N9x7wzaAIFcT3yQ+ELDu1SZ
-dE4lZsf2uMyfj58V8GDOLLE233+LRsRbJ083x+e2mW5BdAGtGgQBusFfnmv5Bxqd
-HgS55hsna5725/44tvxll261TgQvjGrTxwe7e5Ia3d2Syc+e89mXQaI/+cZnylNP
-SwCCvx8mOM847T0XkVRX3ZrwXtHIA25uKsPJzUtksDnAowB91j7RJkjXxJcz3Vh1
-4k182UFOTPRW9jzdWNSyWQGl/vpe9oQ4c2Ly15+/toBo4YXJeDdDnZ5c/O+KKadc
-IMPBpnPrH/0O97uMPuED+nI6ISGOTMLZo35xJ96gPBwyG5s2QxIkKPXIrhgcgUnk
-tSM7QYNhlftT4/yVvYnk0YcCAwEAAQ==
------END PUBLIC KEY-----`.replace(/\\n/g, "\n");
-const getIsFireblocksWebhookValid = (req) => {
-    const signature = req.headers["fireblocks-webhook-signature"];
-    if (!signature) {
+const jose_1 = require("jose");
+const JWKS = (0, jose_1.createRemoteJWKSet)(new URL("https://keys.fireblocks.io/.well-known/jwks.json"));
+const getIsFireblocksWebhookValid = (req) => __awaiter(void 0, void 0, void 0, function* () {
+    const jwsSignature = req.headers["fireblocks-webhook-signature"];
+    if (!jwsSignature || typeof jwsSignature !== "string") {
         return false;
     }
-    const message = JSON.stringify(req.body);
-    const verifier = crypto_1.default.createVerify("RSA-SHA512");
-    verifier.write(message);
-    verifier.end();
-    return verifier.verify(publicKey, signature, "base64");
-};
+    const rawBody = req.rawBody;
+    if (!rawBody) {
+        return false;
+    }
+    try {
+        const [header, , sig] = jwsSignature.split(".");
+        const payload = Buffer.from(rawBody).toString("base64url");
+        const fullJws = `${header}.${payload}.${sig}`;
+        yield (0, jose_1.compactVerify)(fullJws, JWKS);
+        return true;
+    }
+    catch (_a) {
+        return false;
+    }
+});
 exports.getIsFireblocksWebhookValid = getIsFireblocksWebhookValid;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@riocrypto/common-server",
-  "version": "1.0.2741",
+  "version": "1.0.2743",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -28,7 +28,7 @@
     "@google-cloud/secret-manager": "^5.3.0",
     "@google-cloud/storage": "^6.9.5",
     "@hyperdx/node-opentelemetry": "^0.7.0",
-    "@riocrypto/common": "^1.0.2534",
+    "@riocrypto/common": "^1.0.2535",
     "@types/express": "^4.17.13",
     "axios": "^1.7.4",
     "crypto-js": "^4.2.0",
@@ -39,6 +39,7 @@
     "fireblocks-sdk": "^5.13.0",
     "googleapis": "^135.1.0",
     "he": "^1.2.0",
+    "jose": "^6.2.2",
     "jsonwebtoken": "^9.0.1",
     "lodash": "^4.17.21",
     "mongoose": "8.7.2",